2,224 reputation
1917
bio website
location
age
visits member for 2 years, 6 months
seen yesterday

Sep
14
comment XSS : Blacklist characters vs. whitelist
"You may even try if a mailserver accepts the user (Gmail will error when a user does not exist, even before you really sent anything)" do you suggest verifying email validity with RCPT TO instead of the command intended for this (VRFY)?
Sep
14
comment Could browsers improve security of stored passwords by using setuid?
"One of my favorite context ideas is preventing even root from reading /etc/shadow," root can still change its own password, I believe.
Sep
13
comment Javascript Malware: How does it work, and how can it be mitigated?
"Windows User Account Control is one of the best techniques because of how it interrupts every other program when it needs privileges to complete a task." The UAC interface can easily be faked by a local process.
Sep
12
revised Does the following data stream look secure to you?
edited tags
Sep
12
comment Are SSL encrypted requests vulnerable to Replay Attacks?
@CodesInChaos "I know protocols which have everything you mention, and still suffer from replay attacks" protocols implementing a message sequence abstraction? (ordered stream)
Sep
11
awarded  Nice Answer
Sep
10
comment HTTPS Sensitive Information and Caching
@John Reply updated.
Sep
10
revised HTTPS Sensitive Information and Caching
edited tags
Sep
10
comment HTTPS Sensitive Information and Caching
See also Why both no-cache and no-store should be used in HTTP response?.
Sep
10
revised HTTPS Sensitive Information and Caching
Added reply to updated question
Sep
10
answered HTTPS Sensitive Information and Caching
Sep
9
answered Could browsers improve security of stored passwords by using setuid?
Sep
8
revised Is OpenVPN secure if both the certificate and private key, are publicly known?
Edited title
Sep
8
suggested suggested edit on Is OpenVPN secure if both the certificate and private key, are publicly known?
Sep
8
revised Is OpenVPN secure if both the certificate and private key, are publicly known?
edited tags
Sep
7
comment How to verify correct, secure and test setuid?
@RichardBelisle For every SUID that you turn off, there is a potentially useful functionality that is broken. "The following files should have their setuid or setgid bits disabled unless required." It can be very difficult for unexperienced users to determine what is required for what purpose. After changing a file permissions, you might observe that some functionality fail to work in an obvious way, or in a subtle way.
Sep
7
answered How to verify correct, secure and test setuid?
Sep
5
comment Effectiveness of Security Images
@drjimbob I had the impression that most phishing attempt used a fake link in a fake email. "(Or a proactive bank could purchase and enable HSTS for similar domain names)." So similar that the user might type the other name by accident, yes (my-bank.com vs mybank.com); but not confusingly similar based on lack of understanding of the DNS name spaces (mybank.login.secure.banking.something.com)
Sep
5
comment Effectiveness of Security Images
@Ramhound "They would need to know WHICH security image you actually selected." Obviously. "It doesn't actually sound like you know how javascript works." I do, actually. "If they already have the ability to pull YOUR security image for your bank account, then they already have ALL the information they need, to access your bank account." Nonsense.
Sep
5
comment Effectiveness of Security Images
@drjimbob "as well as HSTS" HSTS is only effective on the exact same domain, see my-bank.com vs mybank.com vs mybank.secure-server.com.